Permission Catalog Reference
Stable permission keys used to build SteelEngine roles.
The Permission Catalog is the vocabulary used by seeded and custom roles. Keys are stable identifiers in family:action form. The Roles editor groups them by resource family and displays a plain-language description for each permission.
| Area | Read | Create | Update | Delete or manage |
|---|
| Workspace | workspace:read | workspace:create | workspace:update | workspace:delete |
| Members | workspace:read_members | — | — | workspace:manage_members |
| Settings | — | — | — | workspace:manage_settings |
| Documents | workspace:read_documents | workspace:create_documents | workspace:update_documents | workspace:delete_documents |
| Folders | workspace:read_folders | workspace:create_folders | workspace:update_folders | workspace:delete_folders |
| Workflow folders | workspace:read_workflow_folders | workspace:create_workflow_folders | workspace:update_workflow_folders | workspace:delete_workflow_folders |
| Chats | workspace:read_chats | — | workspace:update_chats | — |
| Inbox | workspace:read_inbox | — | — | workspace:manage_inbox |
| Notifications | workspace:read_notifications | workspace:create_notifications | workspace:update_notifications | workspace:delete_notifications |
| Credentials area | — | — | — | workspace:manage_credentials |
| MCP area | workspace:read_mcp | — | — | workspace:manage_mcp |
| Apps | workspace:read_apps | workspace:create_apps | workspace:update_apps | workspace:delete_apps, workspace:publish_apps |
| Jobs | workspace:read_jobs | workspace:create_jobs | workspace:update_jobs | workspace:delete_jobs |
| Environment | workspace:read_environment | — | — | workspace:read_environment_values, workspace:manage_environment, workspace:manage_byok |
| Memory | workspace:read_memory | — | — | workspace:manage_memory |
| Logs | workspace:read_logs | — | — | — |
| A2A | workspace:read_a2a | workspace:create_a2a | workspace:update_a2a | workspace:delete_a2a, workspace:publish_a2a |
| Family | Permission keys |
|---|
| Workflow | workflow:read, workflow:create, workflow:update, workflow:delete, workflow:execute, workflow:deploy, workflow:manage_public_api, workflow:publish_mcp_tool |
| Knowledge base | knowledge_base:read, knowledge_base:search, knowledge_base:create, knowledge_base:update, knowledge_base:delete, knowledge_base:restore |
| Knowledge document | document:read, document:create, document:update, document:delete, document:sync |
| Search chunk | chunk:search |
| Family | Permission keys |
|---|
| Database | database:read, database:query, database:create, database:update, database:delete |
| Table | table:read, table:query, table:create, table:update, table:delete, table:manage_schema, table:import, table:export |
| Family | Permission keys |
|---|
| Credential | credential:read, credential:use, credential:share, credential:manage, credential:delete |
| Credential set | credential_set:read, credential_set:list, credential_set:create, credential_set:manage |
| API key | api_key:read, api_key:read_workspace, api_key:create, api_key:update, api_key:revoke, api_key:revoke_workspace, api_key:use |
| MCP server | mcp_server:read, mcp_server:manage, mcp_server:refresh, mcp_server:delete |
| Workflow MCP server | workflow_mcp_server:read, workflow_mcp_server:manage |
| MCP tool and scope | mcp_tool:list, mcp_tool:call, mcp_scope:use |
| Built-in tool | tool:read, tool:use, tool:administer |
| Custom tool | custom_tool:read, custom_tool:use, custom_tool:create, custom_tool:update, custom_tool:delete |
| Skill | skill:read, skill:use, skill:create, skill:update, skill:delete |
| Family | Permission keys |
|---|
| Organization | organization:read, organization:update, organization:manage_members, organization:manage_authz, organization:manage_models, organization:manage_api_keys, organization:manage_byok, organization:administer |
| Caller-owned personal data | organization:read_personal_data, organization:read_personal_secrets, organization:manage_personal_data |
| Plan account | plan_account:read, plan_account:manage_billing, plan_account:change_plan, plan_account:manage_seats, plan_account:view_enterprise_audit |
The same action can apply to different target shapes:
- Collection creation uses a parent target, such as
workspace:<id>:documents or workspace:<id>:workflow:*.
- Existing-resource actions use the resource, such as
workflow:<id> or table:<id>.
- Workspace subareas use collection keys, such as
workspace:<id>:folders.
- Organization governance uses keys such as
org:<id>:members and org:<id>:authorization.
You choose the named permission in the UI. SteelEngine builds and evaluates the target pattern for the assignment scope.
Some catalog entries also require a plan or entitlement. Notable examples include organization authorization management, organization API keys, BYOK, seat management, and enterprise audit access. A role grant does not bypass those product requirements.